• Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
    Dedicated community for Japanese speakers
  • 한국 커뮤니티
    Dedicated community for Korean speakers
Exit
0

Prevent Direct Access to Custom Tags

Engaged ,
Jun 12, 2017 Jun 12, 2017

Copy link to clipboard

Copied

Hello all,

I have an application running on CF9 and there are many Custom Tags and CFC files - that some are calling directly. For example, somehow a bot found one and now it tries to index it as a direct URL.

http://www.yourdomain.com/my-custom-tag.cfm

How do I stop any direct URL access  to a CT or CFC - and only allow the CT to run when called?

Views

826

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Advocate ,
Jun 12, 2017 Jun 12, 2017

Copy link to clipboard

Copied

Not storing them in the web root would be the first thing. Is there a reason they need to go in the webroot?

If they must be there, then put them in a sub folder which is only accessible by the CF service, if anyone else navigates to them it will give them a 401/3

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Engaged ,
Jun 16, 2017 Jun 16, 2017

Copy link to clipboard

Copied

Sorry - they are not in the web root - they are in their own folder and available to all websites on the server.

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Advocate ,
Jun 12, 2017 Jun 12, 2017

Copy link to clipboard

Copied

We avoid using custom tags but some of our legacy tags have code similar to the following:

<cfif NOT thisTag.hasEndTag>

    <cfabort showerror="You need to supply a closing &lt;CF_Head&gt; tag.">

</cfif>

<cfif thisTag.executionMode EQ "end">...

You may be able to simply check for the existence of thisTag - isDefined("thisTag").

Another option is updating your application.cfm or application.cfc to white list the templates that can be accessed from the outside world. You can do the same via folders and access permissions similar to what haxtbh mentioned - but restructuring your app may be more difficult than <cfif NOT listFindNoCase("big.cfm,ugly.cfm,list.cf,of.cfm,files.cfm",cgi.script_name)><cfabort showerror="Go away!" /></cfif>

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Expert ,
Jun 17, 2017 Jun 17, 2017

Copy link to clipboard

Copied

LATEST

csgaraglino  wrote

http://www.yourdomain.com/my-custom-tag.cfm

How do I stop any direct URL access  to a CT or CFC - and only allow the CT to run when called?

You could just use the settings in your web-server to deny access to the URL.

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Resources
Documentation